Codex live projector: an explicit cwd outranks a substituted workspace key at the .hypignore gate

[philcunliffe]

Root cause

hypaware-core/plugins-workspace/codex/src/exchange-projector.js

selectCodexWorkspace picks a workspaces turn-metadata key, falling back to
the first key when none matches the request's cwd:

const workspacePath = workspacePaths.find((key) => pathsEqual(key, cwd)) ?? workspacePaths[0]

resolveCodexContext stamped that result as codexContext.cwd, which is the
one resolved cwd (LLP 0083
"One resolved cwd, used twice") that feeds both the .hypignore gate and the
row. So when the request's real cwd matched no declared workspace, the privacy
verdict was computed for a substituted, unrelated directory, and because
workspacePaths[0] is normally absolute, PR #474's usableInBandCwd predicate
accepts it and never sees the problem. The substitution also runs one layer
ahead of that predicate, so an unusable in-band cwd never reaches it.

The design question, answered

A substituted workspace key is a guess about which directory the session ran
in, and a guess must not decide a privacy verdict. But it is not worthless: on
the ChatGPT-subscription route the request often carries no cwd at all, and the
key is then the only in-band source of one. Deleting the substitution would
remove real .hypignore coverage.

So the two roles are separated, which is the distinction the defect conflates:
"may we record this row at all" versus "what do we record about it".

Option chosen: option 1 (separate the roles)

An explicit in-band cwd outranks the workspace key for the gate and the
stamp; the key keeps its enrichment role in full and still supplies the
cwd when the request states none.

cwd: firstString(inBandCwd, workspace?.path),

Chosen over the alternatives:

• Refuse substitution entirely would delete subscription-route .hypignore
  coverage, which is a net privacy loss. Rejected.
• Allow the substitution only when it is an ancestor of the real cwd gives
  the same answer in all three reported cases but is worse in the common
  benign one: it keeps gating on the workspace root and so keeps missing a
  deeper .hypignore under the actual cwd. Using the real cwd gates on the more
  specific directory. It also needs a new ancestor helper for no benefit.
• Option 3, accept and document, leaves a demonstrated leak open.

attributes.codex.workspace, git_remote, git_commit and has_changes are
untouched and still come from the selected key, so no enrichment or graph-bridge
data (LLP 0032#capture) is lost.
selectCodexWorkspace itself is not modified.

Behaviour in the three reported cases

.hypignore of class ignore at /work/ignored.

	workspaces	request cwd	before	after
(a)	{'/work/clean/proj':{}}	/work/ignored/real	RECORDED, row cwd=/work/clean/proj	DROPPED
(b)	{'/work/ignored/proj':{}}	/work/clean/real	DROPPED	RECORDED, row cwd=/work/clean/real
(c)	{'/work/ignored/proj':{}}	sub	DROPPED, silently	RECORDED, row cwd=sub, refusal logged

(a) is the privacy leak and it is closed. (b) is the false drop and it is closed.

Fail-open / fail-closed, explicitly

This fix fails OPEN, in case (c), and that is a trade, not a strict
improvement. Case (c) changes DROP to RECORD. The old drop was not a verdict,
it was luck: the guessed directory happened to be ignored. Refusing the guess
means the honest but unusable sub reaches the gate, where (on this base)
path.resolve measures it against the daemon's own cwd. So this fix trades an
accidental drop for a fail-open record in the one case where the client states
a cwd we cannot use.

That is precisely the hole PR #474 closes, and the two compose: with #474
also landed, case (c) becomes "substitution refused, sub refused as unusable,
rollout fallback consulted, row recorded with cwd = NULL plus a
usage_policy_cwd_unusable warn". This PR does not duplicate #474's
predicate, to keep the diff off the same lines.

Cases (a) and (b) are strictly better. One further consequence, deliberate and
recorded in the LLP: metadata.cwd from the turn-metadata header now reaches the
gate where only the workspace key did before, so a header-declared cwd under an
ignored tree will now correctly drop. And for a session running in a
subdirectory of its workspace the row stamps the subdirectory rather than the
workspace root, which is the directory the policy is actually scoped to.

I make no claim that this dominates every alternative.

Not silent

A refused substitution emits, at warn level, symmetric with #474's sibling
signal:

plugin.codex.usage_policy_workspace_cwd_refused
  component=codex  operation=usage_policy_workspace_cwd_refused
  error_kind=workspace_cwd_mismatch
  workspace_sha256=<16>  cwd_sha256=<16>  exchange_id=<id>

Paths are hashed, never raw: this seam sees LLM traffic. A test asserts the raw
path does not appear in the fields.

Reproducing tests

All in test/plugins/codex-exchange-projector.test.js:

1. the .hypignore gate uses the request cwd, not a substituted workspace key (#476 case a)
2. an unrelated ignored workspace key does not drop a session it never covered (#476 case b)
3. a refused workspace substitution is logged with hashed paths, not silently applied (#476 case c)
4. a refused workspace substitution still enriches the row from the workspace key (#476)
5. the workspace key still supplies the gate cwd when the request states none (#476)
6. no workspace-cwd refusal is logged when the key matches or the request states no cwd (#476)

1-4 fail on origin/master (# tests 42 / # pass 38 / # fail 4; case (a)
fails with a full projection where USAGE_POLICY_DROP was expected) and pass
after. 5 and 6 encode behaviour that must survive the fix and are the
negative-branch guards.

Mutation checks

Every branch of the new logic was reverted individually:

mutation	reddens
cwd: workspace?.path (restore the substitution)	tests 1, 2, 3, 4
cwd: inBandCwd (drop the workspace fallback)	test 5, plus the pre-existing Codex turn metadata + headers project into first-class columns
drop the !pathsEqual guard	test 6
drop the inBandCwd && guard	test 6
rename the log message (silence the signal)	test 3

Verification

• npm test: # tests 2885 / # pass 2876 / # fail 8. The 8 failures are all
  test/core/leave-command.test.js and were verified to fail identically on
  a pristine origin/master worktree with the same node_modules symlink
  (baseline: # tests 2879 / # pass 2870 / # fail 8, same 8 names).
• npm run typecheck: clean.
• npm run smoke -- gateway_codex_capture: ok.
• npm run smoke -- session_optout_capture_drop: ok.

Diff size and conflict surface

3 files, +223 / -6. Of that, 38 lines in exchange-projector.js across 4
hunks, and 16 of those 38 are comment/@ref lines. The functional change is
two expressions plus one log block. 177 lines are tests, 14 are the LLP 0083
amendment.

exchange-projector.js is concurrently modified by PRs #462, #467 and #474,
so the conflict surface was deliberately minimised: selectCodexWorkspace is
not touched, nothing was refactored, reordered or renamed, #474's
usableInBandCwd is not duplicated or moved, and no line either of the held
PRs is likely to rewrite was reformatted. Per the issue, this should land
after #467 and #462 are resolved.

Fixes #476

[philcunliffe]

Neutral review, round 1 of 2

Reviewed head d3a6afc. Everything below was verified by execution against the
real projector and the real shared matcher (createUsagePolicyResolver), in a
detached worktree with a node_modules symlink, not by reading the diff.

Verdict: findings. The central claim holds: case (a) is closed, and closed
more broadly than the PR body advertises. Nothing found is a reason to hold the
PR, and the land order it names (after #467 and #462) is right. One doc-only
commit pushed; four items are left for a human, each a design decision, spelled
out at the end.

1. Case (a) is closed, and so are four variants the body does not mention

.hypignore of class ignore at /work/ignored, one exchange each, injected
existsSync/readFileSync, ttlMs: 0:

scenario	workspaces	in-band cwd	master	d3a6afc
(a)	/work/clean/proj	/work/ignored/real	RECORDED cwd=/work/clean/proj	DROP
(b)	/work/ignored/proj	/work/clean/real	DROP	RECORDED cwd=/work/clean/real
(c)	/work/ignored/proj	sub	DROP, silent	RECORDED cwd=sub + refusal warn
nested keys, cwd under the ignored one	/work/clean/outer, /work/ignored	/work/ignored/deep/dir	RECORDED	DROP
trailing slash on the real cwd	/work/clean/proj	/work/ignored/real/	RECORDED	DROP
dot segments	/work/clean/proj	/work/ignored/real/../real	RECORDED	DROP
turn-metadata header cwd	/work/clean/proj	header cwd=/work/ignored/real	RECORDED	DROP
body metadata.cwd	/work/clean/proj	metadata.cwd=/work/ignored/real	RECORDED	DROP
non-first key matches	/work/clean/a, /work/ignored/real	/work/ignored/real	DROP	DROP
prefix-not-ancestor	/work/ignored	/work/ignored-other/real	DROP (false)	RECORDED

Four rows besides (a) flip from a leak to a correct drop, because pathsEqual
is byte equality after a trailing-slash trim, so every non-identical spelling of
the real cwd used to hand the gate the substituted key. The
prefix-not-ancestor row confirms the matcher's walk is segment-aware
(path.dirname), so /work/ignored-other was a false drop and is now correct.

On the header-cwd question (undisclosed change 1): it cannot cause a wrong
drop that the body cwd would not also cause. readRecordedCwd and the
header cwd feed one firstString, body first, so the header only decides when
the body states nothing; before, that case fell to the key. Every value that now
reaches the gate is a directory the client itself declared for this turn.

Row-stamp change (undisclosed change 2) is contained. attributes.codex.workspace,
git_remote, head_sha, has_changes still come from the selected key
(confirmed on a projected row, not only via the new test 4); repo_root is
deliberately not derived (LLP 0032 #codex-repo-root). The only cwd-keyed
consumer is listCapturedDirectories (src/core/commands/local_only.js:22),
which groups by exact cwd with no ancestor collapsing, so a subdir session now
surfaces in the privacy survey as the subdir instead of the workspace root. That
is how @hypaware/claude rows already behave, so this makes Codex consistent
rather than novel. No existing test encoded the old value: the only test pinning
the pair ("Codex workspace selection prefers recorded cwd over first metadata
key") uses cwd == key, and gateway_codex_capture's
r.cwd === codexWorkspace assertion survives because that fixture states no
in-band cwd.

2. Findings

F1. MEDIUM (privacy, not closed by this PR, also true on master).
hypaware-core/plugins-workspace/codex/src/exchange-projector.js:123-124,
with :733. The refusal only outranks the key with an explicit in-band
cwd. The key still outranks the rollout fallback, because it is folded into
codexContext.cwd before the ??. So on the subscription route, the route
LLP 0083 exists for, a session that declares a workspaces map never consults
session_meta.cwd, and a first-key guess still decides the verdict:

workspaces	in-band cwd	rollout session_meta.cwd	master	d3a6afc
/work/clean/proj	none	/work/ignored/real	RECORDED cwd=/work/clean/proj	RECORDED cwd=/work/clean/proj
none	none	/work/ignored/real	DROP	DROP
/work/clean/a, /work/ignored/proj	none	(none)	RECORDED cwd=/work/clean/a	RECORDED cwd=/work/clean/a

Row 1 versus row 2 is the finding: adding a workspaces header to an otherwise
identical, correctly-dropped exchange turns the drop into a record. This is the
same class as (a) reached through the one door the fix leaves open, and it is
pre-existing, so it is a gap rather than a regression. Recorded in LLP 0083 by
the commit below; the code decision is D1.

F2. MEDIUM (privacy, new in this PR, a net loss versus master for this
input). exchange-projector.js:733. The gate does not canonicalize, so which
spelling reaches it now matters. Real filesystem, .hypignore at
$T/work/ignored, $T/home/me/link a symlink to $T/work/ignored/a/b/c:

in-band cwd	workspaces key	master	d3a6afc
$T/home/me/link (symlink)	$T/work/ignored/a/b/c (canonical)	DROP	RECORDED
$T/work/ignored/a/b/c	$T/home/me/link	RECORDED	DROP

The symlink jumps depth, so the ancestor walk from the symlinked spelling never
passes $T/work/ignored and misses the .hypignore; the row is recorded with a
cwd that resolves into the opted-out tree. It is the same shape as the case (c)
trade the PR does own (refusing a guess costs the drops the guess reached by
luck), but it is a leak rather than a NULL-cwd record, and the body does not name
it. Row 2 shows it is symmetric, not one-directional: neither spelling is
authoritative today. Decision D2.

F3. LOW-MEDIUM (privacy, new). exchange-projector.js:715 with :733.
Keeping enrichment "in full" while taking the gate cwd back means a row that is
now recorded where it used to drop can carry an ignored directory's
identity. Case (b), projected row, verbatim:

cwd: "/work/clean/real"
git_remote: "https://github.com/a/b.git"     <- from /work/ignored/proj
attributes.codex.workspace: "/work/ignored/proj"

The gate is scoped by cwd (LLP 0049 #scope), not by enrichment source, so
this is consistent with the design; it is simply a consequence nobody wrote down,
and the PR's own test 4 avoids it by using a clean workspace key. Decision D3.

F4. LOW (observability). exchange-projector.js:128-137. The refusal
predicate is "not byte-equal", so it fires for the ordinary shape "session
running in a subdirectory of its workspace" and emits a warn on every
turn of such a session (verified: cwd=/work/proj/sub, key /work/proj,
recorded, warn emitted). #474's sibling signal fires only on genuinely
unusable values, so the claimed symmetry does not extend to frequency. Decision
D4.

F5. INFO. A whitespace-only in-band cwd (" ") is a second instance of
the case (c) fail-open that the body does not list: master dropped it on the
ignored key, d3a6afc records it with cwd=" ". Same argument as (c), and
#474's usableInBandCwd refuses it as cwd_blank, so it composes away.

F6. INFO. Once both land, PR #474's LLP 0083 paragraph still says the #476
gap is open ("an absolute-but-unrelated directory can still reach the gate
(#476)"). Whoever merges second should trim that sentence. Not resolved here, per
the brief.

F7. INFO, not this PR's. llp/0083-...decision.md still contains 11 U+2014
characters in pre-existing prose, on lines 12, 21, 33, 36, 44, 54, 55, 68, 101
and 106. #468 only normalized @ref glosses, and the merged hygiene gate only
checks those, so this is a standing CLAUDE.md violation on master. The 16 lines
this PR adds contain none.

3. Claims I re-derived

• Mutation table: all five reproduce exactly as stated. cwd: workspace?.path
  reddens tests 1-4; cwd: inBandCwd reddens test 5 plus "Codex turn metadata +
  headers project into first-class columns"; dropping !pathsEqual reddens test
  6; dropping inBandCwd && reddens test 6; renaming the log message reddens
  test 3. Baseline 43/43.
• #474 composes, and the two merge cleanly. Merging fix/issue-471 into
  this head auto-merged with no conflict, including both LLP 0083 amendments
  to the same decision list. Case (c) on the merged tree: RECORDED,
  cwd = undefined (NULL column), with both
  plugin.codex.usage_policy_cwd_unusable and
  plugin.codex.usage_policy_workspace_cwd_refused. That is precisely the
  composed behaviour the body claims. Cases (a) and (b) are unchanged by the
  merge, and F1's row 1 still records, so the composition does not close it.
• Case (c)'s reasoning holds. The old drop was the guessed key's verdict, not
  the session's; sub resolves against the daemon's own cwd, so the old drop was
  correct only while the daemon happened to run under an ignoring tree.
  Fail-open here is the honest answer, and Codex live projector: an unusable in-band cwd is a miss, not a path (#471) #474 turns it into a NULL cwd.
• New logging is clean. The refused path appears nowhere raw: not in the
  log fields (asserted over the serialized fields), not in the projected row
  (refused_workspace_cwd is never spread into the projection; every field is
  picked by name). Digest idiom is identical to the adjacent drop log
  (sha256Hex(...).slice(0, 16)), and both carry cwd_sha256 for the same
  resolved cwd, so the two correlate. No prompt or payload text reaches the
  fields.
• Ref hygiene passes. test/core/llp-ref-hygiene.test.js is on master but
  not on this branch's base (c551d6e), so I ran it on master merged into this
  branch: 8 pass, 1 skip, 0 fail, and the merge itself was clean.
  LLP 0083#decision resolves (## Decision).
• npm test: 2885 / 2876 pass / 8 fail, the 8 all test/core/leave-command.test.js,
  identical names on a pristine origin/master worktree with the same symlink.
  npm run typecheck clean. npm run smoke -- gateway_codex_capture ok.
  npm run smoke -- session_optout_capture_drop ok.
• Style: the diff adds no U+2014, no trailing semicolons, no @typedef, no
  inline import('...') types.

4. What I changed

One commit, doc only, pushed to fix/issue-476: 0db67e1,
llp/0083-codex-live-cwd-from-rollout.decision.md +16 lines, recording F1, F2
and F3 as three named limits of the amended decision. Deliberately no code:
exchange-projector.js is byte-identical to d3a6afc, so the conflict surface
against #462/#467/#474 is unchanged (re-verified: fix/issue-471 still
auto-merges into the pushed head with no conflict). Verified with
git diff d3a6afc..0db67e1 --stat (one file, +16, 0 deletions), the hygiene test
re-run on the merged tree, and 43/43 on the projector suite.

5. Decisions for a human

• D1 (F1). Should the workspace-key guess rank below the rollout, not
  above it? The change is cwd: inBandCwd at :733, a new
  workspace_cwd: workspace?.path field, and a third ?? codexContext?.workspace_cwd
  term on the gate expression at :123-124, so the order becomes in-band,
  rollout, key. Test 5 stays green (it configures no rollout). Not done here for
  two reasons, both for you to overrule: it is outside the option-1 menu issue
  Codex live projector: the workspace-key substitution can feed the .hypignore gate a directory the session never ran in #476 offered (the rollout is not "an explicit request cwd"), and :123-124
  is the exact line Codex live projector: an unusable in-band cwd is a miss, not a path (#471) #474 rewrites and One reader for the Codex session_meta header, in core (#465) #466 will predicate. Either take it as a
  follow-up issue, or accept and leave LLP 0083 saying so.
• D2 (F2). Canonicalize, or accept? Canonicalizing belongs in the shared
  matcher (LLP 0050, one matcher for all four adapters), costs a realpath per
  cache miss, and would change Claude's behaviour too. Either file it against
  the matcher, or accept the spelling trade as documented.
• D3 (F3). Should enrichment from a workspace key that is itself
  .hypignore-ignored be suppressed on a recorded row? Correct-looking but costs
  a second resolver lookup per exchange and drops graph-bridge identity (LLP 0032
  #capture) for multi-root sessions. Suppress, or accept as documented.
• D4 (F4). Keep the refusal at warn for symmetry with Codex live projector: an unusable in-band cwd is a miss, not a path (#471) #474, or demote to
  info because the common subdirectory session trips it on every turn? Demoting
  is one word plus moving test 3's assertion to the info channel.

None of D1-D4 blocks landing. F1 and F2 are the two I would not leave
undocumented, and they now are documented.

[philcunliffe]

Neutral review, round 2 of 2 (final)

Reviewed head 0db67e18. Everything below was established by execution, not
by reading: the real projector, the real shared matcher
(createUsagePolicyResolver), and for the symlink question a real symlink(2)
on disk with real node:fs, no injection. Three worktrees throughout:
origin/master (1555f13) as control, 0db67e18, and the two merged.

Verdict: findings. Nothing found is a reason to hold the PR, and the central
claim holds: an explicit in-band cwd now outranks a substituted workspace key
at the .hypignore gate, closing case (a) plus the four spelling variants round 1
found. One doc-only commit pushed (fc521d0). Round 1's headline concern is
withdrawn on the evidence: F2 is not a net loss versus master. Every residual
is now filed as its own issue (#479, #480, #481) rather than living only in an LLP
paragraph, since triage classifies but does not fix.

---

1. F2, the symlink leak: reachable, but NOT a net regression

Reachable: yes. $T/work/ignored/.hypignore (class ignore),
$T/home/me/link a real symlink to $T/work/ignored/a/b/c. The matcher alone,
real fs:

resolve($T/work/ignored/a/b/c) -> ignore   governedBy $T/work/ignored/.hypignore
resolve($T/home/me/link)       -> full     governedBy null

Same directory, opposite verdicts. path.resolve is lexical, so the ancestor
walk climbs the symlink's own parents and never meets the governing file. Through
the projector, same symlink:

case	in-band cwd	workspaces key	origin/master	0db67e18
A	symlink	canonical	DROP	RECORDED
B	canonical	symlink	RECORDED	DROP
C	canonical	canonical	DROP	DROP
D	none	symlink	RECORDED	RECORDED

Round 1 measured A only, and concluded "a net loss versus master". That is
wrong. A and B are a symmetric swap: this PR closes the case where the
key held the non-canonical spelling and opens the case where the request
does. And case D, the widest of the three, is identical before and after: on
the ChatGPT-subscription route the request states no cwd at all (the route LLP
0083 exists for), so a declared symlinked key is the only value there is and it
reaches the gate uncanonicalized on both trees. Net across the class this PR is a
wash, not a regression.

Which of A/B is likelier is the real question, and it favours the PR. POSIX
getcwd(2) always returns a fully canonical path, so any cwd a process reads
from its own kernel state is canonical. Non-canonical spellings reach this code
only from declared paths: workspaces turn-metadata keys, local-only list
entries a user types, hyp ignore targets. That is case B (fixed here) and case
D (untouched). Case A needs the client to state a cwd that did not come from
getcwd, such as a --cd-style flag echoed verbatim. The one thing I could
not verify by execution: whether Codex ever sends such a value, since there is
no Codex binary here. That is the crux of round 1's D2 and it is now stated in
the issue rather than guessed at.

Not fixable in this PR, and now demonstrably so. I built the fix and measured
it. Canonicalizing the incoming cwd in matcher.js:resolve closes all four
cases (A/B/C/D all DROP) with zero new test failures on origin/master. It is
still the wrong patch, because it breaks the resolver's other source.
matchList compares the canonicalized cwd against path.resolve(entry.dir),
and nothing in src/core/usage-policy/ calls realpath on either side
(grep -rn realpath is empty). Verified, entry dir a symlink to $T/real/proj:

                        pristine master      one-sided canonicalize
resolve($T/link)   ->   local-only           full

local-only to full means the directory starts forwarding. A one-sided fix
trades one leak for another. The correct fix canonicalizes both sides, touches
readListEntriesSync and the exported isEqualOrDescendant the hyp ignore --local-only CLI shares (LLP 0069 R8), carries a stored-data migration question,
and needs LLP 0049 #scope / 0071 / 0050 amendments. Different subsystem from
this PR's diff, so it does not belong here.

Filed as #479, neutral:fix only, deliberately not neutral:stuck: the
subject code (src/core/usage-policy/matcher.js) is on master and leaks there
today, both via cases B and D and via @hypaware/claude, whose
projector.js:206 is resolver.resolve(cwd) on the transcript cwd verbatim with
no compensating second source. So it is immediately actionable and the
branch-only rule does not apply. Overrule me if you disagree.

2. F1: confirmed pre-existing, byte-identical, now tracked

exchange-projector.js:130-131 with :723. Injected rolloutCwd that counts
its calls, session_id present so the fallback is genuinely eligible:

#	workspaces	in-band cwd	rollout session_meta.cwd	verdict	rollout consulted
1	{/work/clean/proj}	none	/work/ignored/real	RECORDED cwd=/work/clean/proj	false
2	none	none	/work/ignored/real	DROP	true

Identical on origin/master, on 0db67e18, and on the two merged. Rows 1 and 2
differ in nothing but the presence of a workspaces header, so adding one to a
correctly-dropped exchange turns the drop into a record. rollout_consulted=false
is the mechanism: the key is folded into codexContext.cwd before the ??, so
the rollout is never asked. Not created and not widened by this PR. Round 1's
D1 patch shape is carried into the issue. Filed as #480, neutral:fix (the
defect is on master), with the #477/#474/#462 overlap on those exact lines noted
in prose so a worker sequences rather than opening a fourth concurrent edit.

3. D3 and D4: verified, left unfixed, filed as #481

Both confirmed by execution, both branch-only, so #481 carries
neutral:fix and neutral:stuck naming #477 as the blocker.

D3, LOW-MEDIUM, privacy (identity, not content). :715 with :733. The case
this PR newly records produces a row naming the opted-out tree:
cwd=/work/clean/real, attributes.codex.workspace=/work/ignored/proj,
git_remote=git@github.com:acme/SECRET-REPO.git, head_sha=cafebabe, where
origin/master DROPPED and no row existed. Documenting it is not quite
enough, which is why it is filed: only the identity leaks, never content, and
it is defensible by design (the gate is scoped by cwd, LLP 0049 #scope, not by
enrichment source), but the row is new surface. Decision in #481: suppress
enrichment from a key that itself resolves to ignore, or accept. Note this PR's
own test 4 pins the opposite behaviour using a clean key, so it does not
constrain the choice.

D4, LOW, observability. :125-137. Confirmed: workspaces={/work/proj},
in-band cwd=/work/proj/sub, both clean, no .hypignore anywhere, nothing
privacy-relevant happening, and the branch emits 1 refusal warn per turn
against 0 on master. I did not demote it, despite it being one word. #474
modifies this file and was mid conflict-resolution during this review, and #462
touches it too; round 1 bought a byte-identical exchange-projector.js
specifically to keep that surface small, and a log-level change on a non-leak does
not justify spending it. #481 offers two fixes: demote to info, or keep warn
and skip the benign ancestor case using isEqualOrDescendant rather than a second
copy of the path logic.

4. Semantic drift against the moved master

master advanced 64 commits (#466, #467 among them). Checked, all clean:

• The branch's added lines cite LLP 0032, 0049, 0050 and 0083 only. No
  reference to 0143 or 0144 anywhere in the diff, so the 0143 to 0150 and 0144
  to 0151 renumbering does not touch it.
• No duplicated predicate. One reader for the Codex session_meta header, in core (#465) #466 landed sessionMetaCwd in
  src/core/codex/rollout_session_meta.js and rewrote
  codex/src/rollout-cwd.js; this branch touches neither, and the reuse
  follow-up is already filed correctly as Codex live projector's usableInBandCwd should reuse sessionMetaCwd now that #466/LLP 0150 landed #478 (neutral:fix +
  neutral:stuck).
• The merge with current origin/master is clean, mergeable=MERGEABLE
  confirmed after my push.
• Not this PR's, noted in passing: origin/master carries two LLP 0142 claimants
  (0142-openclaw-plugin-steered-shadow-providers and
  0142-privacy-surface-and-skill-discoverability), which is the same class as
  LLP 0098, 0099 and 0111 each have two claimants; the renumber-vs-qualified-citation choice is unowned and needs a decision #469.

5. Gates

• Ref hygiene passes. test/core/llp-ref-hygiene.test.js (on master via
  LLP corpus hygiene: illustrative @refs are marked and no gloss uses an em dash (#463 items 2 and 3) #468, not on this branch's base) run against this branch merged with current
  master: 8 pass, 1 skip, 0 fail, both before and after my commit.
• npm test on the merged tree: 2923 pass / 8 fail / 2 skip. The 8 are all
  test/core/leave-command.test.js, name-for-name identical on a pristine
  origin/master worktree with the same node_modules symlink. Not this PR's.
• npm run typecheck clean. npm run smoke -- gateway_codex_capture ok.
• Projector suite 43/43 on 0db67e18.
• Tests are load-bearing. Reverting the fix on the merged tree
  (cwd: firstString(inBandCwd, workspace?.path) back to cwd: workspace?.path)
  reddens exactly the four new Codex live projector: the workspace-key substitution can feed the .hypignore gate a directory the session never ran in #476 tests (cases a, b, c and the enrichment test).
• Hashed-path logging still leaks nothing. refused_workspace_cwd is never
  spread into the projection; the log carries workspace_sha256 and cwd_sha256
  only, and the raw path appears in neither.
• CLAUDE.md compliance: the diff adds zero U+2014, zero semicolon-terminated
  JS lines, no @typedef, no inline import('...') types. My commit is em-dash
  neutral (10 lines contain one before and after, none added, none removed); those
  are the pre-existing violations tracked by Repo-wide em dash (U+2014) violates CLAUDE.md's house style outside @ref glosses #472.

6. What I changed

One commit, doc only: fc521d0,
llp/0083-codex-live-cwd-from-rollout.decision.md, +23 / -14.
exchange-projector.js is byte-identical to both 0db67e18 and d3a6afc
(git diff --stat empty for that path against both), so the conflict surface
against #462 and #474 is unchanged from round 1. The commit makes each stated
limit cite its issue (#479, #480, #481) and corrects the third limit, which round
1 had written as a trade this amendment makes; on the evidence above it is a
pre-existing matcher property, the amendment swaps which spelling trips it, and
the widest case is unchanged. Verified by
git diff 0db67e18..fc521d0, re-running the hygiene test and the full suite on
the merged tree, and the smoke.

7. What a human still has to decide

Nothing blocks landing. The land order round 1 named (after #467 and #462) still
holds. Three decisions, each now an issue with the options and the measurements:

• Usage-policy matcher never canonicalizes: a symlinked spelling of an ignored directory escapes its .hypignore (all adapters, hyp purge, query visibility) #479 (F2, the symlink leak). Canonicalize the shared matcher, both
  sides, with the local-only migration, or accept. Do not take the one-line
  version: it is measurably a different leak.
• Codex live projector: a workspaces turn-metadata header preempts the rollout session_meta.cwd, turning a correct .hypignore drop into a record #480 (F1). Rank the workspace-key guess below the rollout, or accept.
• Follow-up: deferred review findings from PR #477 (ignored-workspace identity on newly-recorded rows; refusal warn fires every turn) #481 (D3 and D4). Suppress enrichment from an ignored key, or accept; and
  demote the refusal warn to info or narrow its predicate.

Not re-verified, needs a recheck: the composition with #474. Round 1
verified it by a real merge, but #474 was being conflict-resolved in parallel
while I worked and its head is moving, so re-checking against it would have
measured a branch that no longer exists. Whoever settles #474 should re-run the
composed case (c) and confirm the NULL-cwd-plus-both-signals behaviour, and trim
#474's LLP 0083 sentence that still says the #476 gap is open.

This was round 2 of 2. The PR is still a draft; I did not mark it ready, did
not merge, and did not edit the PR body.

[philcunliffe]

Triage of PR #477 at head fc521d06 (LLP 0017 rung; 2-round review budget exhausted, draft, CI green, MERGEABLE).

Round 2's commit (fc521d06, "LLP 0083: the stated limits of the workspace-key refusal cite their issues") is doc-only (llp/0083-codex-live-cwd-from-rollout.decision.md, +23/-14; confirmed by git diff d3a6afc fc521d06 -- .../exchange-projector.js = empty) and had never been reviewed. I read and independently verified it.

Verdict on the round-1-vs-round-2 reversal: round 2 is correct. I did not take its word for it — I built real on-disk symlinks (fs.symlinkSync, real node:fs, no injected stubs) and ran the actual createCodexExchangeProjector end to end on both origin/master (1555f13) and this PR's head:

scenario	master	PR #477
symlinked workspace key, canonical request cwd (real subdir of the ignored root)	RECORD (leak)	DROP
canonical workspace key, symlinked request cwd	DROP	RECORD (leak)
widest case: symlinked key, no in-band cwd at all (subscription route)	RECORD (leak)	RECORD (leak)

This is exactly the symmetric swap the doc claims, not a net loss: the PR closes the case where the declared workspace key carries a non-canonical spelling and opens the case where the request's own cwd does. The reason this favors the branch is structural, not hopeful: readRecordedCwd/turn-metadata cwd are populated from the client's own process cwd, and POSIX getcwd(3) is documented to return the resolved path with no symlink components — a real Codex client's in-band cwd should already be canonical, so the "opens" row above requires a client that reports its cwd through some path other than a real getcwd() call, which is not how codex-tui/std::env::current_dir() behaves. Workspace keys, by contrast, come from user/config-declared paths and have no such guarantee. The widest case (symlinked key, subscription route with no request cwd) leaks identically before and after — that's the pre-existing shared-matcher defect (#479), not this PR's.

I also spot-checked the four round-1 "master leaks" variants by direct execution (real projector, stub resolver): trailing-slash, dot-segment, and metadata.cwd-header mismatches all RECORD (leak) on master and DROP correctly on this PR's head; case (a)/(b)/(c) tests (all 43 in test/plugins/codex-exchange-projector.test.js) pass at the head.

LLP 0083 text at fc521d06: accurate. No "net loss" language remains (removed vs the round-1 framing). It correctly cites all three filed follow-ups (#479 shared-matcher canonicalization, #480 workspace-header-preempts-rollout, #481 enrichment identity + refusal-warn noise) with descriptions that match each issue's actual content and labels.

Residuals — confirmed accurately described and correctly labelled, not re-filed:

• Usage-policy matcher never canonicalizes: a symlinked spelling of an ignored directory escapes its .hypignore (all adapters, hyp purge, query visibility) #479 (neutral:fix only) — shared matcher never canonicalizes; leaks today on master via any of the four adapter seams, hyp purge, query-visibility. Usage-policy gate matches directories, not path spellings: canonicalize both sides #482 is open and fixes it (canonicalizes both sides of the matcher). Checked whether Usage-policy gate matches directories, not path spellings: canonicalize both sides #482 landing would change my judgement here: no — Usage-policy gate matches directories, not path spellings: canonicalize both sides #482 is a strict, orthogonal improvement that shrinks risk for both master and this PR's remaining "opens" edge case; it doesn't retroactively make Codex live projector: an explicit cwd outranks a substituted workspace key at the .hypignore gate #477 unsafe today, and Codex live projector: an explicit cwd outranks a substituted workspace key at the .hypignore gate #477 doesn't need to wait on it.
• Codex live projector: a workspaces turn-metadata header preempts the rollout session_meta.cwd, turning a correct .hypignore drop into a record #480 (neutral:fix + neutral:stuck) — workspace header preempts rollout session_meta.cwd; confirmed pre-existing byte-identical on master, correctly stuck on the same contended file.
• Follow-up: deferred review findings from PR #477 (ignored-workspace identity on newly-recorded rows; refusal warn fires every turn) #481 (neutral:fix + neutral:stuck, branch-only) — D1 (ignored-workspace identity on newly-recorded rows) and D2 (refusal warn fires every turn on an ordinary subdirectory session). Both correctly branch-only (D1's row didn't exist before this PR; D2's log line is new code).

None of the three is mislabelled.

D3 / enrichment-identity leak (#481 D1) — judged non-blocking, tracking in #481 is sufficient. It leaks only identity (a workspace path string, a redacted-userinfo git remote, a commit sha), never session content, and only in a narrow multi-workspace shape (a clean real cwd alongside a different, ignore-flagged declared workspace key). On master this exact row never existed at all — but only because master over-drops it (case (b): master would have wrongly suppressed a legitimate, non-ignored session). The counterfactual that matters here: holding this PR back to close a low-severity identity leak leaves case (a) — a full content record of a session that should have been dropped — shipping in production. That trade isn't close.

#474 composition re-verified at its current head (ce76b56c, moved since round 1's merge check): merged fc521d06 with origin/master then with ce76b56cbce4cf33e77a5419c034564c655a0275 — auto-merge, zero conflicts, all 58 tests in test/plugins/codex-exchange-projector.test.js pass. Directly executed the composed case (c): a relative in-band cwd + a non-matching declared workspace key produces a recorded row with cwd = undefined and both warns (plugin.codex.usage_policy_cwd_unusable error_kind=cwd_not_absolute, and plugin.codex.usage_policy_workspace_cwd_refused error_kind=workspace_cwd_mismatch) — matches round 1's verified composition. The two LLP 0083 amendments (#474's usableInBandCwd bullet and #476/#477's substituted-workspace-key bullet) coexist as separate bullets with no contradiction. (Note for whoever merges #474 second: its own LLP 0083 paragraph still says "an absolute-but-unrelated directory can still reach the gate (#476)" — stale once #477 is in; #481 already flags this as cleanup for the second PR to land, not this one's problem.)

Ref hygiene: test/core/llp-ref-hygiene.test.js merged with current origin/master (1555f13): 8 pass, 1 skip (pre-existing, unrelated to #476/#477 — issue #463 item 1), 0 fail.

test/core/leave-command.test.js: 3 pass / 8 fail identically on this PR's head and on a pristine origin/master worktree with the same node_modules symlink — not this PR's, matches the PR's own verification claim.

Every residual finding here is non-blocking. Follow-ups already exist (#479/#480/#481); no new issue filed.